Developer Tools
JSON FormatterBase64 Encoder / DecoderHTML Minifier & BeautifierMarkdown PreviewerRegex TesterJWT DecoderView all 25

JWT Decoder

Decode a token with expiry status, a security audit, and ready-to-use code snippets.

Runs in your browserNo sign-up required

More Than Just Decoding

A raw decoded payload only answers half the question a developer actually has. This tool also checks whether the token is still valid, scans the header and claims for real, known JWT vulnerabilities (an unsigned "alg: none" token, a missing expiry, an unusually long lifetime), can verify an HS256 signature against a secret, diff two tokens' claims, and hand back ready-to-paste code using the token as a Bearer header.

Useful for: backend and API developers debugging auth issues, and security engineers auditing what a token actually contains before trusting it.

How to Use This Tool

  1. 1Paste a tokenDecoded instantly into a readable header and payload.
  2. 2Check the expiry statusValid, expiring soon, or already expired — computed from the exp claim.
  3. 3Review the security auditFlags real issues: alg set to "none", missing exp/aud claims, unusually long lifetimes.
  4. 4Verify or compareCheck an HS256 signature against a secret, or diff two tokens' claims side by side.

Good to Know

  • A token isn't saved anywhere by this tool — not in local storage, not in session storage. It only exists in the page while you have it open, since JWTs often carry sensitive session data.
  • The "alg: none" check catches a real, historically-exploited JWT vulnerability — some libraries would accept an unsigned token if an attacker simply removed the signature and set the algorithm to "none".
  • Signature verification only works for HS256 (a shared-secret algorithm) — RS256/ES256 use a public/private key pair and would need the public key rather than a plain secret to verify.
  • The code snippets show the token as a Bearer header across curl, fetch, Axios, Python, and Go — copy whichever matches what you're actually building.

Frequently Asked Questions

Can decoding a JWT tell me if it's legitimate?

Decoding alone just reads the contents — anyone can decode a JWT, since the payload isn't encrypted, only encoded. Legitimacy requires signature verification against the actual secret or public key the issuer used, which is a separate step this tool also supports for HS256 tokens.

Why does my token show no expiry warning?

If the token has no "exp" claim at all, it's flagged in both the expiry status and the security audit — such a token never expires on its own, which is itself worth knowing.

Is it safe to paste a production token into this tool?

Nothing is transmitted anywhere or saved to storage — decoding, the security audit, and signature verification all run entirely in your browser. That said, treat any tool handling live credentials with the same caution you'd apply anywhere else.

What does the "diff two tokens" feature help with?

It's built for exactly the kind of debugging where a dev-environment token behaves differently from a production one — pasting both shows precisely which claims differ instead of comparing two blocks of JSON by eye.